Received: by 2002:ac0:bc90:0:0:0:0:0 with SMTP id a16csp4956245img; Tue, 26 Mar 2019 22:07:27 -0700 (PDT) X-Google-Smtp-Source: APXvYqxRVXNK6t1ltOTKiKE9qgHRrv+RYSjfsgvZSrtiLpyuDblzbqVuPUf4/jcTL5Ou2sJnEM8d X-Received: by 2002:a17:902:8d93:: with SMTP id v19mr35239193plo.271.1553663247680; Tue, 26 Mar 2019 22:07:27 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553663247; cv=none; d=google.com; s=arc-20160816; b=MjoQbEoaPX44CezI8D+2a01ZlFQC3W+ElcRJ+JDXu/R4Q7h96gBp5zo/LrOquC2DMt pr0Q8tjtp1CZoOVeWrelQZytx3bZQnlMLNyYNC36EuNELgzuoUbueeSNRUebOpuI/Sqp f4ZQGd571J98WTJVJiTV0784tQZsrKt/wMudpWjX9yDqr0IoxdO1nfIXr93L1V+kKKk1 hPVfu5eFaybJGR8AtXKm+0Im4s7P8u7IRUxKTSXDLgwg1l3XxEXlloVk1SH9wq/K+R3R tJPQcpJ0ewxrM/DOYfWRt28VBjgs0bDWrj/0AxJRe3YO8wexgdX/NGSnlPuwP0mN5zaA bNeQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:user-agent:in-reply-to :content-disposition:mime-version:references:message-id:subject:cc :to:from:date:dkim-signature; bh=o7pNULS9LxI6cBJeZ1hUYOETmdJLJxSjzzPhspyqa+w=; b=MP4kWaZJwvD8HO7Oef61pg7cVOzM8bitw8xQFfnnD8XMK+w0pXnSxZllvsaIumYkbW uUsuE+5o5xiKSgI/GWEBAlyMkCmql9+ivHyzlqczhqao16GXaZQZXsTg2FYLWIhzTwFI obIsqANBwqSSUmHdpWOJQ47HnsZcvFslwJ8Vr27Z99aYaAm26ayHx5rwkLy7I0ZvEhcX LydGJdkSfFB85fHieXTSd+dFsQsMblJxIoSInpLJx90cdUg1EjzaZE2K8tEEGC5oYhnb DjTcKaUR39UyCoiyEpXlQnjCjq8xJvCIo1oBIaVF6BFBN72dExI4fEyUFs3x1n6yl+B8 9kEg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=0ou0fetd; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id c13si474606pfb.67.2019.03.26.22.07.12; Tue, 26 Mar 2019 22:07:27 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=0ou0fetd; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726320AbfC0FGV (ORCPT + 99 others); Wed, 27 Mar 2019 01:06:21 -0400 Received: from mail.kernel.org ([198.145.29.99]:58306 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725730AbfC0FGV (ORCPT ); Wed, 27 Mar 2019 01:06:21 -0400 Received: from localhost (unknown [218.148.84.253]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 5F4C62075E; Wed, 27 Mar 2019 05:06:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553663179; bh=YU8HZwQxdJ/LsudojfVFvkvdnB7dDpy+PRZOVfT6WFE=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=0ou0fetdclvdObXbaTv+ylMApdBnmPrzm4el0bWWPmgZHFK263+XZg89riVsAgeJc wCFbH4std2qnmzcKWj3RqPDqSUbEzXSR12lfySAlTk5QQEy7IFv6rMwFJYLOi74dDZ L4RfwerNu45ah2DXNK7WF9wQeRP+Zy8PkMg4ZzXU= Date: Wed, 27 Mar 2019 14:06:15 +0900 From: Greg KH To: Andy Lutomirski Cc: Matthew Garrett , James Morris , LSM List , LKML , David Howells , Linux API , Matthew Garrett Subject: Re: [PATCH V31 25/25] debugfs: Disable open() when kernel is locked down Message-ID: <20190327050615.GA548@kroah.com> References: <20190326182742.16950-1-matthewgarrett@google.com> <20190326182742.16950-26-matthewgarrett@google.com> <20190327003057.GA27311@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.11.4 (2019-03-13) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Mar 26, 2019 at 09:29:14PM -0700, Andy Lutomirski wrote: > On Tue, Mar 26, 2019 at 5:31 PM Greg KH wrote: > > > > On Tue, Mar 26, 2019 at 12:20:24PM -0700, Andy Lutomirski wrote: > > > On Tue, Mar 26, 2019 at 11:28 AM Matthew Garrett > > > wrote: > > > > > > > > From: Matthew Garrett > > > > > > > > debugfs has not been meaningfully audited in terms of ensuring that > > > > userland cannot trample over the kernel. At Greg's request, disable > > > > access to it entirely when the kernel is locked down. This is done at > > > > open() time rather than init time as the kernel lockdown status may be > > > > made stricter at runtime. > > > > > > Ugh. Some of those files are very useful. Could this perhaps still > > > allow O_RDONLY if we're in INTEGRITY mode? > > > > Useful for what? Debugging, sure, but for "normal operation", no kernel > > functionality should ever require debugfs. If it does, that's a bug and > > should be fixed. > > > > I semi-regularly read files in debugfs to diagnose things, and I think > it would be good for this to work on distro kernels. Doing that for debugging is wonderful. People who want this type of "lock down" are trading potential security for diagnositic ability. good luck! greg k-h